qelso Posted January 31, 2018 Posted January 31, 2018 Привет всем! Столкнулся с проблемой, не работает policy-options на import маршрутов в ospf. Juniper MX80, JUNOS 12.3R4.6 routing-instances { NextOne { instance-type vrf; interface xe-0/0/0.4015; interface xe-0/0/0.4019; protocols { ospf { export ospf-vrf-NextOne-export; import ospf-vrf-NextOne-import; area 0.0.0.0 { interface xe-0/0/0.4015 { metric 150; authentication { md5 19 key "***"; ## SECRET-DATA } } interface xe-0/0/0.4019 { metric 150; authentication { md5 20 key "***"; ## SECRET-DATA } } } } } } } policy-options { policy-statement ospf-vrf-NextOne-import { term 1 { from { protocol ospf2; route-filter 83.167.66.225/32 exact; route-filter 83.167.66.226/32 exact; route-filter 10.100.101.118/32 exact; route-filter 83.167.66.1/32 exact; route-filter 83.167.66.5/32 exact; route-filter 83.167.66.9/32 exact; route-filter 83.167.66.10/32 exact; route-filter 83.167.66.16/32 exact; route-filter 83.167.66.19/32 exact; route-filter 83.167.72.1/32 exact; route-filter 83.167.81.1/32 exact; route-filter 83.167.88.1/32 exact; route-filter 10.100.101.44/30 orlonger; route-filter 83.167.65.0/24 orlonger; route-filter 83.167.66.160/29 orlonger; route-filter 83.167.66.164/30 orlonger; } then accept; } term 2 { then reject; } } } Но в NextOne.inet.0 попадают маршруты, которые не должны туда попадать Скрытый текст > show route table NextOne.inet.0 protocol ospf NextOne.inet.0: 3440 destinations, 3475 routes (3440 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 10.100.101.44/30 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 10.100.101.118/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.238 via xe-0/0/0.4015 10.222.255.52/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 10.222.255.56/30 *[OSPF/10] 6d 03:16:52, metric 162 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.0/24 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.40/29 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.65.52/30 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.56/30 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.60/30 *[OSPF/150] 01:20:10, metric 20, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.1/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.5/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.8/32 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.9/32 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.10/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.11/32 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.12/32 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.13/32 *[OSPF/10] 6d 03:16:52, metric 162 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.16/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.22/32 *[OSPF/10] 6d 03:16:52, metric 163 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.32/30 *[OSPF/10] 6d 03:33:04, metric 160 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.36/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.40/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.44/30 *[OSPF/10] 2d 00:26:41, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.52/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.64/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.68/30 *[OSPF/10] 6d 03:33:04, metric 200 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.72/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.80/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.84/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.96/30 *[OSPF/10] 6d 03:33:04, metric 200 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.100/30 *[OSPF/10] 6d 03:16:52, metric 200 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.104/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.108/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.120/30 *[OSPF/10] 6d 03:33:04, metric 200 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.140/30 *[OSPF/10] 6d 03:16:52, metric 160 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.144/29 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.152/30 *[OSPF/10] 6d 03:16:52, metric 200 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.156/30 *[OSPF/10] 6d 03:16:52, metric 200 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.160/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.188/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.225/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.226/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.236/31 *[OSPF/10] 6d 03:33:04, metric 180 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.244/31 *[OSPF/10] 6d 03:07:28, metric 300 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.246/31 *[OSPF/10] 6d 01:28:25, metric 300 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.248/31 *[OSPF/10] 6d 03:16:52, metric 180 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.252/31 *[OSPF/10] 6d 03:03:38, metric 300 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.254/31 *[OSPF/10] 6d 02:58:33, metric 300 > to 83.167.66.250 via xe-0/0/0.4019 83.167.67.4/30 *[OSPF/10] 6d 03:16:52, metric 160 > to 83.167.66.250 via xe-0/0/0.4019 83.167.72.1/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.88.1/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.0.160/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.0.164/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 172.16.0.172/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.0.180/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.1.32/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 172.16.6.4/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.6.16/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.6.248/29 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.20.49.64/27 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 224.0.0.5/32 *[OSPF/10] 6d 03:43:55, metric 1 MultiRecv Пробовал менять policy: policy-options { policy-statement ospf-vrf-NextOne-import { term 2 { then reject; } } Однако, в NextOne.inet.0 попадают все те же маршруты. Ребята-джуноводы, помогите, пожалуйста, советом. Как отфильтровать import ospf маршруты? Вставить ник Quote
vvertexx Posted January 31, 2018 Posted January 31, 2018 Ну так, какие проходят мимо? external надеюсь фильтруешь? Хотя бы пару примеров приведи. Вставить ник Quote
orlik Posted January 31, 2018 Posted January 31, 2018 2 hours ago, qelso said: Привет всем! Столкнулся с проблемой, не работает policy-options на import маршрутов в ospf. Juniper MX80, JUNOS 12.3R4.6 routing-instances { NextOne { instance-type vrf; interface xe-0/0/0.4015; interface xe-0/0/0.4019; protocols { ospf { export ospf-vrf-NextOne-export; import ospf-vrf-NextOne-import; area 0.0.0.0 { interface xe-0/0/0.4015 { metric 150; authentication { md5 19 key "***"; ## SECRET-DATA } } interface xe-0/0/0.4019 { metric 150; authentication { md5 20 key "***"; ## SECRET-DATA } } } } } } } policy-options { policy-statement ospf-vrf-NextOne-import { term 1 { from { protocol ospf2; route-filter 83.167.66.225/32 exact; route-filter 83.167.66.226/32 exact; route-filter 10.100.101.118/32 exact; route-filter 83.167.66.1/32 exact; route-filter 83.167.66.5/32 exact; route-filter 83.167.66.9/32 exact; route-filter 83.167.66.10/32 exact; route-filter 83.167.66.16/32 exact; route-filter 83.167.66.19/32 exact; route-filter 83.167.72.1/32 exact; route-filter 83.167.81.1/32 exact; route-filter 83.167.88.1/32 exact; route-filter 10.100.101.44/30 orlonger; route-filter 83.167.65.0/24 orlonger; route-filter 83.167.66.160/29 orlonger; route-filter 83.167.66.164/30 orlonger; } then accept; } term 2 { then reject; } } } Но в NextOne.inet.0 попадают маршруты, которые не должны туда попадать Reveal hidden contents > show route table NextOne.inet.0 protocol ospf NextOne.inet.0: 3440 destinations, 3475 routes (3440 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 10.100.101.44/30 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 10.100.101.118/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.238 via xe-0/0/0.4015 10.222.255.52/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 10.222.255.56/30 *[OSPF/10] 6d 03:16:52, metric 162 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.0/24 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.40/29 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.65.52/30 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.56/30 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.65.60/30 *[OSPF/150] 01:20:10, metric 20, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.1/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.5/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.8/32 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.9/32 *[OSPF/150] 01:20:10, metric 120, tag 0 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.10/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.11/32 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.12/32 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.13/32 *[OSPF/10] 6d 03:16:52, metric 162 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.16/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.22/32 *[OSPF/10] 6d 03:16:52, metric 163 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.32/30 *[OSPF/10] 6d 03:33:04, metric 160 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.36/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.40/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.44/30 *[OSPF/10] 2d 00:26:41, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.52/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.64/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.68/30 *[OSPF/10] 6d 03:33:04, metric 200 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.72/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.80/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.84/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.96/30 *[OSPF/10] 6d 03:33:04, metric 200 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.100/30 *[OSPF/10] 6d 03:16:52, metric 200 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.104/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.108/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.120/30 *[OSPF/10] 6d 03:33:04, metric 200 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.140/30 *[OSPF/10] 6d 03:16:52, metric 160 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.144/29 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.152/30 *[OSPF/10] 6d 03:16:52, metric 200 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.156/30 *[OSPF/10] 6d 03:16:52, metric 200 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.160/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.188/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.66.225/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.226/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.236/31 *[OSPF/10] 6d 03:33:04, metric 180 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.244/31 *[OSPF/10] 6d 03:07:28, metric 300 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.246/31 *[OSPF/10] 6d 01:28:25, metric 300 > to 83.167.66.238 via xe-0/0/0.4015 83.167.66.248/31 *[OSPF/10] 6d 03:16:52, metric 180 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.252/31 *[OSPF/10] 6d 03:03:38, metric 300 > to 83.167.66.250 via xe-0/0/0.4019 83.167.66.254/31 *[OSPF/10] 6d 02:58:33, metric 300 > to 83.167.66.250 via xe-0/0/0.4019 83.167.67.4/30 *[OSPF/10] 6d 03:16:52, metric 160 > to 83.167.66.250 via xe-0/0/0.4019 83.167.72.1/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 83.167.88.1/32 *[OSPF/150] 01:20:10, metric 120, tag 0 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.0.160/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.0.164/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 172.16.0.172/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.0.180/30 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.1.32/30 *[OSPF/10] 6d 03:16:52, metric 161 to 83.167.66.250 via xe-0/0/0.4019 > to 83.167.66.238 via xe-0/0/0.4015 172.16.6.4/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.6.16/30 *[OSPF/10] 6d 03:16:52, metric 162 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.16.6.248/29 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 172.20.49.64/27 *[OSPF/10] 6d 03:16:52, metric 161 > to 83.167.66.250 via xe-0/0/0.4019 to 83.167.66.238 via xe-0/0/0.4015 224.0.0.5/32 *[OSPF/10] 6d 03:43:55, metric 1 MultiRecv Пробовал менять policy: policy-options { policy-statement ospf-vrf-NextOne-import { term 2 { then reject; } } Однако, в NextOne.inet.0 попадают все те же маршруты. Ребята-джуноводы, помогите, пожалуйста, советом. Как отфильтровать import ospf маршруты? А что вы фильтруете ? Вы учли что The filtering is done only on external routes in OSPF. The intra-area and interarea routes are not considered for filtering. Вставить ник Quote
qelso Posted January 31, 2018 Author Posted January 31, 2018 @vvertexx , верное замечание. Сразу не обратил внимание, LSA5 фильтруются. Помимо разрешенных в policy-options маршрутов, прилетают LSA 3, которые согласно policy-options, не должны попадать в таблицу. Видимо, @orlik прав: The filtering is done only on external routes in OSPF. The intra-area and interarea routes are not considered for filtering. Коллеги подсказывают: "you are correct in that you cannot filter intra-area routes with the ospf import statement. However, you could configure the routes as martians under routing-options to prevent them from being installed in the routing table." Но что-то не хочется городить. Есть идеи, помимо the routes as martians? Или смириться? Вставить ник Quote
v_r Posted January 31, 2018 Posted January 31, 2018 Inter-area можно фильтровать на границах area, но делается это не через import-policy а через area-range в соответствующей area. Вставить ник Quote
qelso Posted January 31, 2018 Author Posted January 31, 2018 @v_r , спасибо. Но мне это не подходит, данный джун не ABR. Не смотря на это попробовал заюзать area-range вместе с network-summary-import - не помогло. Вставить ник Quote
Mystray Posted January 31, 2018 Posted January 31, 2018 На крайний случай можно через routing-options forwarding-table export <policy> предотвратить установку конкретных роутов в pfe. Но зачем? Вставить ник Quote
orlik Posted February 1, 2018 Posted February 1, 2018 11 hours ago, Mystray said: На крайний случай можно через routing-options forwarding-table export <policy> предотвратить установку конкретных роутов в pfe. Но зачем? +1 полностью поддерживаю , если очень мешают можно не инставить в фиб Вставить ник Quote
qelso Posted February 1, 2018 Author Posted February 1, 2018 @Mystray, @orlik, чтобы клиенты из этого vrf могли ходить только на разрешенные хосты. Решили пока забить, т.к. ничего страшного не должно произойти. Но за наводку спасибо, буду иметь ввиду. Вставить ник Quote
v_r Posted February 1, 2018 Posted February 1, 2018 ACL на интерфейсе не решит задачу? Вставить ник Quote
qelso Posted February 2, 2018 Author Posted February 2, 2018 @v_r, не знаю, пока нет времени продумывать это. Пусть пока так работает. Но за совет, спасибо. Тему можно считать закрытой. Вставить ник Quote
.png.5d2afa2996cc6a85d0f2c09b92dd0a28.png)
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.